Getting Started

In this exercise, you will practice examining and configuring a simple LAN topology. You will begin by launching the GNS3 network emulator.

1. From the dock at the bottom of the screen, click the Terminal icon to open a new Terminal window.
   
2. At the command prompt, type gns3 & and press Enter to open GNS3 in the background.
   
   It will take a few minutes for GNS3 to launch. When GNS3 opens, you will be asked to create a project or open an existing project.
   
3. In the Project window, click the Projects library tab, then select Network Devices Basics and click OK.
   
   When prompted, click No to ignore the update check.
   
   GNS3 will next open the Network Device Basics lab topology. You will see a large window in the center (the topology window). This simulated LAN consists of three hosts (Linux-1, Linux-2, and firefox), two switches, one router, and a firewall. There is also an Internet Service Provider (ISP) and a simulated Internet-facing host called Web.
   

   

Part 1: Examine the Firewall Device

In the next steps, you will examine the pfSense firewall device. In this topology, the pfSense firewall device is a multi-purpose network appliance that provides firewall, router, and DHCP server functionality. In this topology, the pfSense firewall device functions as the LAN's primary router and default gateway.

First, you will need to boot up the firewall and power on the simulated network.

1. In the topology window, right-click the pfSense firewall device and select Start to power up the firewall.
   

   

2. When the network interfaces turn green, right-click the pfSense firewall and select Console from the context menu.
   
   A VNC console will open. Wait until you see the following screen before continuing to the next step:
   

   

   Note: The firewall can take up to 3 minutes to fully boot up.
   
3. Close the VNC console window.
   
4. On the GNS3 control bar, click the Start button (the large green arrow) to power on all devices.
   
   When prompted, click Yes to continue.
   
   In the GNS3 topology window, you will see all connections turn green, indicating the hosts are powered on and connected to the network.
   

   

5. In the topology window, right-click the firefox host and select Console to open a VNC console connection to the firefox host.
   
   As the host's name indicates, the TigerVNC console will launch with a Firefox window open. You will use the Firefox browser to connect to the pfSense appliance's web GUI. Although you could interact with the pfSense appliance directly through the command line interface that you saw when you started the device, the web GUI is easier to use for instructional purposes.
   
6. In the web browser, click the pfSense.cybrary.lab bookmark to connect to the pfSense firewall.
   
7. On the pfSense login page, click the Sign In button to sign in using the saved credentials.
   
8. From the menu bar at the top, click Interfaces and select LAN to open the Interfaces / LAN (em1) configuration page.
   

   

9. On the Interfaces / LAN (em1) configuration page, scroll down to the Static IPv4 Configuration section confirm the firewall's internal IPv4 address.
   

   

10. From the menu bar at the top, click Interfaces and select WAN open the Interfaces / WAN (em0) configuration page.
    
11. On the Interfaces / WAN (em0) configuration page, scroll down to confirm the firewall's external IP address. Also, take note of the Upstream gateway.
    
    In this simulated LAN, the firewall acts as the default gateway for the LAN. The firewall will pass all traffic to its own default gateway - the device labeled ISP. As in the real world, this LAN connects to the Internet using an Internet Service Provider (ISP). The ISP's job is to route traffic to and from the Internet on behalf of the firewall. The firewall's job is to manage Internet traffic on behalf of the LAN.
    
    In the next steps, you will test your connection to the ISP.
    
12. From the pfSense menu bar, click Diagnostics and select Ping to open the Ping diagnostic tool.
    
13. On the Diagnostics / Ping page, type 66.67.68.1 in the Hostname field, then click Ping to ping the ISP device.
    
    At the bottom of the page, you should see a positive result.
    

    

Part 2: Examine the DHCP Server and Host Network Configurations

In the next steps, you will examine the DHCP Server running on the pfSense firewall appliance. DHCP stands for Dynamic Host Configuration Protocol. DHCP grants clients an IP Address (and other networking options) from a predefined pool of addresses. Hosts on the LAN configured to use DHCP will automatically be assigned an IP address when they boot up.

1. From the menu bar at the top, click Services and select DHCP Server.
   
   On the Services / DHCP Server / LAN page, notice that DHCP is enabled.
   

   

2. Scroll down to see the Range of IP addresses.
   
   This DHCP server will provide IPs from .100 to .200 on the 192.168.1.0/24 network. Scroll down further and note that clients are also sent the firewall's internal LAN address as the default gateway.
   
3. Minimize the TigerVNC console window.
   
4. In the topology window, right-click Linux-1 and select Console from the context menu.
   
   A new tab called Linux-1 will open in your original Terminal window. You may need to restore the Terminal window.
   
5. On the Linux-1 tab, type cat /etc/network/interfaces and press Enter to display the contents of the network configuration file for Linux-1.
   

   

   Notice that the Static configuration is commented out, but the DHCP configuration section is not. Linux-1 should get an IP Address and a gateway from the firewall's DHCP server. Let's confirm.
   
6. On the Linux-1 tab, type ifconfig and press Enter to display the network configuration.
   

   

   Notice that Linux-1 indeed has an IP Address from the address pool on the firewall.
   
7. On the Linux-1 tab, type netstat -rn and press Enter to confirm the default gateway.
   

   

   Note: 0.0.0.0 means the same thing as the default gateway.
   
8. Restore the TigerVNC console.
   
9. In the TigerVNC console, right-click the M icon in the lower left-hand corner, then select terminal to open a new LXTerminal inside the TigerVNC console.
   

   

10. Repeat steps 5-7 in the LXTerminal window to confirm the network configuration for the firefox host.
    
    You will see that DHCP has also provided the firefox host an IP address and default gateway.
    
11. Close the LXTerminal window, but leave the web browser inside the TigerVNC console open.

Part 3: Examine the Firewall Rules

In the next steps, you will examine the pfSense appliance's firewall feature. You will begin by reviewing the rules table for the WAN interface.

1. In the TigerVNC console, scroll up to the menu bar at the top in the open web browser, then click Firewall and select Rules.
   

   

   Notice there are no rules configured for the WAN side of the firewall. By default, ALL inbound traffic is blocked. The only exception is for traffic that is in reply to valid requests made from internal clients. PfSense is a stateful firewall; as such, it knows when a valid request is made from an internal client and will accommodate the reply without needing a written inbound rule.
   
2. Click the LAN tab.
   

   

   You should see three rules on the Firewall / Rules / LAN page. The first rule ensures we can connect to the firewall's web configuration page on port 80. The second rule allows all IPv4 traffic from the LAN network to any destination. The third rule allows all IPv6 traffic from the LAN Network to any destination. In a nutshell, the firewall, by default, lets everything out and nothing in.
   
   Note: While this default firewall configuration is fine for a lab, a production firewall should limit outbound traffic to only what is needed. For example, many shops only allow web traffic to exit the network. Imagine the havoc malware could wreak if given free outbound Internet access from a contaminated host!
   
   The current firewall ruleset means that clients on the LAN should be able to reach anything on the "Internet." Let's test this.
3. Minimize the TigerVNC console.
   
4. In the topology window, right-click Web and select Console from the context menu.
   
5. In the Web tab, type ifconfig and press Enter to see the Web device’s IP Address.
   
6. In the Linux-1 tab, ping the Web device’s IP address.
   
   Given the firewall rules table, you should be able to ping the external Web device from the internal Linux-1 device.
   
7. In the Web tab, ping the ISP device (66.67.68.1), then ping the firewall's WAN interface.
   
   Can Web ping our ISP's address? How about the firewall? Did you expect the firewall to allow or deny ping based on the rules seen in Steps 1 and 2?

Part 4: Configure a New Subnet

Next, let's focus on the Router and Linux-2 devices in our LAN. Although the Router appears to be connected to the rest of the network via Switch 1, its network configuration file is actually empty. In the next steps, we will configure the Router to accommodate a new network subnet that serves Switch2 and Linux-2: 10.10.10.0/24. The Router will therefore need two NICs: one in the 192.168.1.0/24 network and one in the new 10.10.10.0/24 network.

Let's begin!

1. Right-click the Router device and select Auxiliary console (not Console).
   
   A new tab called Router will open in the terminal window.
   
2. On the Router tab, type cat /etc/network/interfaces and press Enter to display the router’s configuration file. You will see that everything is commented out.
   
   

   

   While we could edit /etc/network/interfaces using the vi text editor, let's take advantage of this virtual environment and use a GNS3 shortcut instead.
   
   Note: You are welcome to use the vi editor if you are comfortable with it.
   
3. In the GNS3 topology, right-click the Router device and select Configure from the context menu.
   
   The Node properties window will open.
   
4. At the bottom of the Node properties window, next to Network configuration, click Edit.
   
   The Router interfaces editor will open.
   
5. In the Router interfaces editor, configure the router as follows, then click Save.
   
   Static config for eth0
   eth0 address: 192.168.1.254
   eth0 netmask: 255.255.255.0
   gateway: 192.168.1.1
   
   Static config for eth1
   eth1 address: 10.10.10.1
   eth1 netmask: 255.255.255.0
   

   

6. Click OK to close the Node properties window.
   
7. In the GNS3 topology, right-click the Router device and select Stop from the context menu, then right-click the Router device again and select Start to restart the router.
   
8. In the GNS3 topology, right-click the Router device and select Auxiliary console from the context menu to re-open the Router tab in the terminal.
   
9. On the Router tab, type ifconfig and Press Enter to confirm the new IPs have been configured for eth0 and eth1 (ignore eth2).
   

   

10. On the Router tab, use the netstat -rn command to verify that the firewall LAN address (192.168.1.1) is the default gateway.
    
11. On the Router tab, ping the firewall's LAN address.
    
12. As you did with the Router, use GNS3 to configure Linux-2 as follows:
    
    Static config for eth0
    eth0 address: 10.10.10.100
    eth0 netmask: 255.255.255.0
    eth0 gateway: 10.10.10.1
    
    

    

13. Open a Console for Linux-2.
    
14. In the Linux-2 tab, ping the Router's internal IP address ( 10.10.10.1), then ping the firewall's LAN IP address ( 192.168.1.1).
    
    You should find that the Router replies, but the Firewall does not. This does not mean that your ping requests did not reach the firewall - after all, Linux-2 is aware of the Router device as its gateway, and the Router device is aware of the Firewall device as its gateway. Rather, it means that the Firewall does not know where to send its response.
    
    The Firewall device knows about the two networks it’s connected to (192.168.1.0/24 and 66.67.68.0/24) and where to send all other traffic (66.67.68.1), but it does not know about 10.10.10.0/24, nor will 66.67.68.1 know anything about an internal network. To resolve this, we will need to tell the Firewall where to route traffic for 10.10.10.0/24. We will accomplish this by adding a routing statement that instructs the firewall to send all traffic destined for 10.10.10.0/24 to the Router.
    
15. Restore the TigerVNC console.
    
16. In the web browser, from the menu bar at the top, click System, then select Routing to open the System / Routing / Gateways page.
    
17. On the System / Routing / Gateways page, click Add to add a new gateway.
    
18. On the System / Routing / Gateways / Edit page, configure the new gateway as shown below, then scroll down to the bottom and click Save.
    
    Disabled: Off
    Interface: LAN
    Address Family: IPv4
    Name: Router
    Gateway: 192.168.1.254
    

    

    The new gateway should appear on the System / Routing / Gateways page.
    
19. On the System / Routing / Gateways page, click Apply Changes, then select the Static Routes tab.
    
20. On the System / Routing / Static Routes page, click Add to add a new static route.
    
21. Configure the new static route as follows, then click Save.
    
    Destination network: 10.10.10.0 / 24
    Gateway: Router - 192.168.1.254
    

    

22. On the System / Routing / Static Routes page, click Apply Changes.
    
    It may take 30-60 seconds to add the new route.
    
23. On the menu bar at the top, click Firewall and select Rules, then select the LAN tab.
    
    By default, the firewall allows all traffic from the "LAN net. In our case, the LAN net only includes 192.168.1.0/24, not 10.10.10.0/24. We could add a new rule for the 10.10.10.0/24 network or edit the existing rule to make it more permissive. Because this is a lab environment, we will just revise the current rule.
    
24. On the Firewall / Rules / LAN page, click the Edit button (the Pencil) for the second rule.
    
25. On the Firewall / Rules / Edit page, scroll down and change the Source from LAN net to any, then scroll down and click Save.
    

    

26. On the Firewall / Rules / LAN page, click Apply Changes.
    
    It may take 30-60 seconds to make the change.
    
    We should now be able to reach the firewall and beyond from the 10.10.10.0/24 LAN.
    
27. In the terminal window, on the Linux-2 tab, try once more to ping the firewall ( 192.168.1.1).
    
    Note: The first few pings may fail if you try to test too quickly after adding the new network to the firewall.
    
28. On the Linux-2 tab, ping the Web device.
    
    As with the firewall, you should now be able to reach the Web device.
    
29. Close all open consoles and GNS3.
    
    In this lab, you explored and configured a small Local Area Network hosted in GNS3. You learned some basic firewall management for pfSense. You also added a new network segment and tested connectivity to and from the Internet. You are now ready for a challenge.